SSL Decryption Fails from Unexpected Message Client "hs_type 0"

• NGFW
• Supported PANOS versions
• SSL Forward Proxy decryption

Consider an example as mentioned below where the SSL decryption is configured on the firewall, and the source is 192.168.35.66 connecting to server 203.213.110.163.

> show session all filter destination 203.213.110.163

--------------------------------------------------------------------------------
ID          Application    State   Type Flag  Src[Sport]/Zone/Proto (translated IP[Port])
Vsys                                          Dst[Dport]/Zone (translated IP[Port])
--------------------------------------------------------------------------------
456823       web-browsing   DISCARD FLOW  NS   192.168.35.66[48282]/L3-Trust/6  (10.129.82.35[61442])
vsys1                                          203.213.110.163[443]/L3-Untrust  (203.213.110.163[443])

> show session id 456823

Session          456823

        c2s flow:
                source:      192.168.35.66 [L3-Trust]
                dst:         203.213.110.163
                proto:       6
                sport:       48282           dport:      443
                state:       INIT            type:       FLOW
                src user:    unknown
                dst user:    unknown

        s2c flow:
                source:      203.213.110.163 [L3-Untrust]
                dst:         10.129.82.35
                proto:       6
                sport:       443             dport:      61442
                state:       INIT            type:       FLOW
                src user:    unknown
                dst user:    unknown

        start time                           : Wed Aug 16 16:45:54 2017
        timeout                              : 15 sec
        total byte count(c2s)                : 2568
        total byte count(s2c)                : 3605
        layer7 packet count(c2s)             : 20
        layer7 packet count(s2c)             : 8
        vsys                                 : vsys1
        application                          : web-browsing  
        rule                                 : Trust-to-Untrust
        session to be logged at end          : True
        session in session ager              : False
        session updated by HA peer           : False
        address/port translation             : source
        nat-rule                             : Trust-NAT(vsys1)
        layer7 processing                    : enabled
        URL filtering enabled                : True
        URL category                         : computer-and-internet-info
        session via syn-cookies              : False
        session terminated on host           : False
        session traverses tunnel             : False
        captive portal session               : False
        ingress interface                    : ethernet1/3
        egress interface                     : ethernet1/1
        session QoS rule                     : N/A (class 4)
        tracker stage firewall               : proxy decrypt failure  
        end-reason                           : decrypt-error

> debug dataplane packet-diag show setting

--------------------------------------------------------------------------------
Packet diagnosis setting:
--------------------------------------------------------------------------------
Packet filter
  Enabled:                   yes
  Match pre-parsed packet:   no            
  Index 1: 192.168.35.66[0]->203.213.110.163[0], proto 0
           ingress-interface any, egress-interface any, exclude non-IP
           ingress-interface any, egress-interface any, exclude non-IP
  Index 2: 203.213.110.163[0]->10.129.82.35[0], proto 0
           ingress-interface any, egress-interface any, exclude non-IP
           ingress-interface any, egress-interface any, exclude non-IP
  Index 3: 203.213.110.163[0]->192.168.35.66[0], proto 0
           ingress-interface any, egress-interface any, exclude non-IP
           ingress-interface any, egress-interface any, exclude non-IP
--------------------------------------------------------------------------------
Logging
  Enabled:                   no
  Log-throttle:              no
  Sync-log-by-ticks:         yes            
  Features:
    flow    : basic 
    proxy   : basic timer detail 
    ssl     : basic

The decryption fails because the server is sending a "Hello request" that is causing the firewall to end the session since it is not supported. The following errors are seen in the packet-diag logs when the detailed debugging is enabled "hs_type 0" as seen below.

2017-08-16 16:45:55.392 +0800 Error: pan_ssl3_process_handshake_msg(pan_ssl3.c:1022): unexpected message client hs_type 0 
2017-08-16 16:45:55.392 +0800 Error: pan_ssl_proxy_handle_rt_hs(pan_ssl_proxy.c:237): pan_ssl3_process_handshake_msg() failed -1
2017-08-16 16:45:55.392 +0800 Error: pan_ssl_proxy_parse_data(pan_ssl_proxy.c:591): pan_ssl_parse_record() failed
192.168.35.66[48282]-->203.213.110.163[443]
2017-08-16 16:45:55.392 +0800 pan_proxy_handle_error(pan_proxy.c:1878): handle error -1
2017-08-16 16:45:55.392 +0800 debug: pan_proxy_ssl_check_block_error(pan_proxy.c:1862): In session(456823), encounters error_id(-1 PAN_SSL_ERROR_GENERAL), action: skip
2017-08-16 16:45:55.392 +0800 debug: pan_proxy_ssl_proc_data(pan_proxy_ssl.c:1010): pan_ssl_proxy_parse_data() failed -1, not block

The screenshot below shows the server is sending a “Hello Request” message, asking the client to re-initiate the SSL/TLS handshake

This type of handshake is currently not supported for decryption.

Workaround:
Create a decryption exception for the HTTPS sites that fail due to SSL renegotiation.

1. Policy-Based Exclusions

Use this method for traffic you choose not to decrypt, such as financial, healthcare, or executive traffic

• Create a "No Decrypt" Rule: Navigate to Policies > Decryption and add a new rule. Set the Action to No Decrypt
• Define Match Criteria: You can exclude traffic based on:
  • URL Categories: Add predefined categories like financial-services or health-and-medicine
  • Source/Destination: Exclude specific source IP addresses (e.g., for executives) or destination servers (e.g., finance servers)
  • External Dynamic Lists (EDL): Use EDLs for dynamically changing environments like Office 365
• Apply a No-Decryption Profile: (Best Practice) Attach a decryption profile to the rule to continue checking for expired certificates or untrusted issuers, even if the traffic isn't decrypted
• Rule Order: Place exclusion rules at the top of your decryption rulebase to ensure they are evaluated before more general decryption rules

2. SSL Decryption Exclusion List

• Predefined Exclusions: Palo Alto Networks maintains a list of commonly known sites that break decryption. You can view these under Device > Certificate Management > SSL Decryption Exclusions
• Custom Exclusions: If a site is not in the predefined list, add it manually:
    1. Go to Device > Certificate Management > SSL Decryption Exclusions
    2. Click Add and enter the Hostname (e.g., *.example.com). Wildcards are supported
    3. Commit your changes
  

3. GlobalProtect Split Tunneling

If you are using Prisma Access or GlobalProtect, you can exclude traffic from the VPN tunnel entirely using Split Tunneling. This is often used for high-bandwidth, low-risk traffic like video streaming

• Navigate to the GlobalProtect Gateway > Agent > Client Settings > Split Tunnel
• Add specific domains or IP subnets to the Exclude list
   

For more information related to this message type, refer to RFC-5246